Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in…
Impact
Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 10.5.12Ecosystem versions | 10.5.12 |
| From 10.6.0 before 10.6.11Ecosystem versions | 10.6.11 |
| From 11.2.0 before 11.2.14Ecosystem versions | 11.2.14 |
| From 11.3.0 before 11.3.12Ecosystem versions | 11.3.12 |
| From 11.0.0 before 11.1.0Ecosystem versions | 11.1.0 |
| From 11.1.0 before 11.2.0Ecosystem versions | 11.2.0 |
Version evidence: OSV · DRUPAL-CORE-2026-007
View original version evidence (477 explicit versions)
Original source description
Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition.
This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cache poisoning or a redirect to an attacker-controlled domain.